GajShield Threat Advisory — Langflow MCP Server Command Injection (CVE-2026-105740, CVE-2026-105697)

Severity: Critical | Priority: 1

Langflow is a visual builder for AI agents and LLM workflows. In versions before 1.9.0, any logged-in user can add a “stdio” MCP server whose command Langflow passes straight to a shell without validation, and the command runs on the Langflow server whenever the server list is loaded. That includes non-admin accounts and accounts created through auto-login or self-registration. The flaw is tracked as CVE-2026-105740 (CVSS 9.9). CVE-2026-105697 is a related command injection in the same feature, also rated 9.9.

The malicious server entry is saved in the project’s settings. The command therefore runs again every time the list loads, and it doesn’t show up when you review flows.

Honeypot data recorded 1,423 exploitation attempts from 27 IP addresses between September 19, 2026 and mid-October, with a sharp rise from October 11. Attackers ran reconnaissance commands, read system files, used Docker to reach the host filesystem, and tried to steal Langflow’s secret key and superuser password.

If an exploit alert is raised, treat the Langflow server as compromised, because the command runs as soon as the server list is loaded. Then:

1. Isolate the server. Identify the account that made the request and its source address.
2. In Langflow, review every configured MCP server in every project. Delete any entry whose command is a shell, a script interpreter, or anything you did not configure.
3. Check the server or container for reverse-shell connections, new processes, cron jobs, cryptominers, and access to the Docker socket.
4. Rotate every secret Langflow holds:
   • the Langflow secret key and superuser password
   • every API key stored in Langflow variables or flows, such as OpenAI, AWS and database credentials
   • any cloud credentials available on the host
5. Review the account that sent the request, and disable it if it isn’t a trusted user.
6. Block the source IP addresses and any exfiltration destination addresses listed in the alerts.

Whether or not you see alerts, upgrade Langflow to 1.9.0 or later. Until you can:

• Set LANGFLOW_AUTO_LOGIN=false and disable open user registration.
• Limit Langflow accounts to trusted users.
• Don’t expose Langflow directly to the internet or to untrusted networks.

Malicious entries persist after the upgrade, so review the MCP server settings in existing projects as well.